# GPT Token: fee mechanism exploit drains pair via skim

GPT token fee mechanism broken; attacker flash-loaned BUSD, manipulated pair via skim, and drained ~$42k.

- Payout: Real-world hack
- Severity: high
- Program: GPT Token
- Analysis by: DeFiHackLabs
- Disclosed: 2023-05-25
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-05/GPT_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230525-gpt
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm vuln:business-logic vuln:flash-loan

**Target:** BSC PancakeSwap pair for GPT/BUSD
**Root cause:** Token fee mechanism broken, allowing attacker to manipulate pair reserves via repeated small transfers and skim calls.
**Steps:**
1. Flash loan BUSD from five DPPOracle contracts in sequence.
2. Call `pair.sync()` to update reserves.
3. Swap 100,000 BUSD for GPT via PancakeRouter.
4. Loop 50 times: `GPT.transferFrom(address(this), address(pair), 0.5 ether); pair.skim(address(this));`
5. Swap remaining GPT for BUSD and repay flash loans.
**Exploitation:** Attacker flash-loaned BUSD, swapped for GPT, then used repeated small GPT transfers and skim to manipulate the pair's reserves, extracting ~$42k in BUSD.
**Insight:** Broken fee-on-transfer tokens can be exploited by repeatedly calling skim after small transfers to drain reserves; check token fee logic for inconsistencies.